Verification · Threat modeling · Weakness discovery
Multi-tenancy isolation
Check every query and cache key for tenant scoping.
How to build it
- List every query, cache key and queue topic that holds tenant data.
- Confirm each one includes the tenant identifier taken from the request context.
- Add a test that reads one tenant's data while authenticated as another and expects no result.
Signals in a repository
- Query helpers that take a tenant_id or tenant argument.
- Cache key builders that prefix keys with a tenant identifier.
- Cross-tenant access tests in the test suite.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.